Invalid SSL Certificate / Steam Under attack?

[generaldurandal]

When I go to the Steam Store in the app I get a blank page saying,
Invalid SSL Certificate

When I go to the Steam Store in a browser, I get,
Your connection is not private
Attackers might be trying to steal your information from store.steampowered.com
(for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID

Help improve Chrome security by sending URLs of some pages you visit, limited system information, and some page content to Google. Privacy policy

~

What's going on?
Is Steam under some kind of DOS attack?

~

This server could not prove that it is store.steampowered.com;
its security certificate is from *.preprod.pt.playstation.net.
This may be caused by a misconfiguration or an attacker intercepting your connection.

[Flava Clown]

When you say "app" do you mean the mobile app? I don't get any error there, nor in the browser (Firefox).

[generaldurandal]

Originally posted by Flava Clown:

When you say "app" do you mean the mobile app? I don't get any error there, nor in the browser (Firefox).

The app you install on your PC,
it's it's own browser thing just for steam.

[Flava Clown]

Originally posted by generaldurandal:

Originally posted by Flava Clown:

When you say "app" do you mean the mobile app? I don't get any error there, nor in the browser (Firefox).

The app you install on your PC,
it's it's own browser thing just for steam.

That's the "Steam client". I don't get any error messages there. Maybe someone hijacked your host file/DNS.

Edit: Are you sure that you visit this site with the browser https://store.steampowered.com/

Go to your client settings (Steam -> Settings -> Interface) and turn "Display Steam URL address bar when available" on and check if it shows "Valve Corp" in green.

[Cathulhu]

Additonally, make sure your timezone, date and timesettings are correct as that can affect certificates as well.

[ShelLuser]

Also also: make sure your OS and environment is up to date. SSL works in a "2-way" strategy meaning that the certificate of a website gets authenticated by a "master certificate" which resides on your computer. OS updates will make sure that those "master certificates" (real name: CA certificates) remain up to date.

So if you try to access websites using an outdated environment you may indeed run into such errors, because the certificate used by the website may no longer correspond to the "master certificates" stored on your computer.

If this is the case you have 2 options: ignore the warnings (which isn't always a bad thing) or update your environment (which should be obvious enough).

[McGillicutti]

Suggestion to the OP: Please go to www.malwarebytes.com and download the virus scanner there for your phone, they make many different ones. The point being to ask that you please make sure your devices you're having this issue on aren't infected or may even contain a "PUP" (Potentially Unwanted Program that's put on by advertisers and is right now not considered malware even if it may act similarly).

Just a suggestion to help make sure you're not being misdirected by something on the device, and it may be an infection the connection detects and that may also be why you're having the issue.

[generaldurandal]

Originally posted by Flava Clown:

Originally posted by generaldurandal:

The app you install on your PC,
it's it's own browser thing just for steam.

That's the "Steam client". I don't get any error messages there. Maybe someone hijacked your host file/DNS.

Edit: Are you sure that you visit this site with the browser https://store.steampowered.com/

Go to your client settings (Steam -> Settings -> Interface) and turn "Display Steam URL address bar when available" on and check if it shows "Valve Corp" in green.

Still has the same blank page.
I noticed,
http://error/
is the site name/link.

[Flava Clown]

Originally posted by generaldurandal:

Still has the same blank page.
I noticed,
http://error/
is the site name/link.

Try to delete the cache in the Client (and your browser).
Steam -> Settings -> Web Browser

Try a different DNS server, like 8.8.8.8 or 8.8.4.4

[ShelLuser]

Originally posted by generaldurandal:

Still has the same blank page.
I noticed,
http://error/
is the site name/link.

That is not a real site. Also notice that it has 'http' in front which means that regular HTTP is being used, thus no SSL involved.

[McGillicutti]

Until they are sure the device is clean, everything else could be based on dirty information.

[anhbloginc]

Originally posted by generaldurandal:

When I go to the Steam Store in the app I get a blank page saying,
Invalid SSL Certificate

When I go to the Steam Store in a browser, I get,
Your connection is not private
Attackers might be trying to steal your information from store.steampowered.com
(for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_COMMON_NAME_INVALID

Help improve Chrome security by sending URLs of some pages you visit, limited system information, and some page content to Google. Privacy policy

I have confronted this issue several times and in fact, it's not about the Steam store side. It's about your device side.

There are a few things you need to take a look at, for example:

- the date and time of your computer, make sure it's correct so the SSL certificate can work properly
- clean out web browser cached
- clean out DNS cached on your computer

To verify the scope of this issue on your computer, you can open another web browser to test, for example, Mozilla Firefox or Opera. If this issue also persists on those web browsers, then probably something goes wrong with the DNS cached files, just clean it up. Otherwise, the reason is from your current web browser.

Source: Fix Your Connection Is Not Private Error In Your Browser[bytebitebit.com]

[Ixothial]

I get this error on both of my laptops when they are on my home network, but for at least one of them (I haven't tried the other,) I don't get the error when it is on my work network.

The Steam Store page loads fine in the client and in a browser from my work network. From home both browser and client have a problem with the certificate. There is no additional firewall at home (just Windows FW, which is the same in both locations) although there is an additional Firewall at work, but that is getting through.

[Phantom]

Originally posted by Ixothial:

I get this error on both of my laptops when they are on my home network, but for at least one of them (I haven't tried the other,) I don't get the error when it is on my work network.

It could just be your ISP, causing you issues, but that is rare.

Change your DNS settings, flush your DNS cache, disable any VPNs/proxys.

Check the time/date on your OS and fully re-boot your PC afterwards.

[Ixothial]

Yeah, that's all I could think of that would not follow the laptop. If it was reversed, I would just assume it was my work's firewall, but getting through at work and not home points me toward DNS. Will check it out when I'm home again.

Edit: Comcast DNS, btw.

[ShelLuser]

Originally posted by Ixothial:

I get this error on both of my laptops when they are on my home network, but for at least one of them (I haven't tried the other,) I don't get the error when it is on my work network.

Make sure you're using an updated browser on an updated OS. If either of these isn't met then you can get these kinds of issues. Of course the time / date settings are also important, but to get an error about invalid certificates your time settings would need to be seriously off.

This has nothing to do with DNS nor the ISP you're using.

The main issue is that a browser needs to check the legitimacy of a certificate and it does that by checking it against a so called 'master certificate'. Well... if your browser is outdated then this could result in your computer not getting the latest update(s) of these master certificates, eventually resulting in a browser which doesn't recognize these master certificates anymore.